CVE-2022-2325

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownInvitation Based Registrations>= 2.2.84, <= 2.2.84

References

Timeline

Published
Aug 1, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-232525.5Microsoft Office Information Disclosure VulnerabilityCVE-2022-232536.5Windows Point-to-Point Tunneling Protocol Denial of Service VulnerabilityCVE-2022-232544.9Microsoft Power BI Information Disclosure VulnerabilityCVE-2022-232555.9Microsoft OneDrive for Android Security Feature Bypass VulnerabilityCVE-2022-232564.3Azure Data Explorer Spoofing VulnerabilityCVE-2022-232578.8Windows Hyper-V Remote Code Execution VulnerabilityCVE-2022-232584.3Microsoft Edge for Android Spoofing VulnerabilityCVE-2022-232598.8Microsoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityCVE-2022-23268.1An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versioCVE-2022-232615.3Microsoft Edge (Chromium-based) Tampering VulnerabilityCVE-2022-232626.3Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-232637.7Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-2325: Medium severity, CVSS 4.8 | Vulnix